Passing a password as a tool argument means it lands in the model's context, the transcript and anywhere either of those is logged. Replacing it with a pair of identifiers that only the local vault can resolve removes that whole class of exposure without asking anyone to be careful. The scope is deliberately narrow — plain text, no attachments, one tool — which keeps the surface small enough that the guarantee is easy to believe.
An MCP server that sends plain-text email over SMTP, built so the credentials never reach the assistant. The SMTP address, password, host and port are stored in MGC Blackbox, a local encrypted vault; the tool call carries only the identifiers naming which stored credential to use.
- One email sent, taking `to`, `subject` and `body` plus the two identifiers that select the stored credential — `send_email`
- A credential boundary that holds by construction: the password is read from the local vault at send time, so it is never part of the tool arguments the model produces
- Compatibility with any SMTP provider, since the stored config is just address, password, server and port
- Trigger phrases the client can match on, so the tool fires on ordinary requests to send something
An SMTP account and MGC Blackbox: `pip install mgc-blackbox`, then run `mgc`. Write a JSON file with your `address`, `password`, `smtp_server` and `smtp_port` and store it with `mgc_save info_type=config info_owner=your_email < config.json` — those two identifiers are what you later pass to the tool, and you choose them. Clone the skill folder from the repository and run `python mcp_server.py`. Limits worth knowing before you wire it in: plain-text bodies only, no attachments and no HTML. MIT licensed.